SPLK-1002 Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. What is the most likely cause of this error?

Accepted Answer

The lookup definition [geo_lookup] does not exist in transforms.conf. The error 'Could not find lookup table' indicates that Splunk cannot find a lookup definition named 'geo_lookup' in transforms.conf. This is the most likely cause because the lookup definition (stanza) is missing or misconfigured. If the file geo.csv were missing but the definition existed, the error would mention 'file not found'. Permission errors produce a different message, and a misspelled field would not cause this error. Therefore, option A is correct.

Answer

The lookup file geo.csv is not present in the lookups directory

Answer

The field src_ip is misspelled in the lookup table

Answer

The user does not have read permission on the lookup table

Question 2

In a dashboard panel, a table shows event counts by source. The user wants to click on a sourcetype to drill down to a new search showing all events from that source. Which token-based drilldown approach is correct?

Accepted Answer

Set a drilldown action to 'search' with a search string containing $row.sourcetype$.. Using $row.sourcetype$ in a drilldown search string passes the clicked value dynamically. Option A is wrong because custom JavaScript is unnecessary and not the recommended token-based approach. Option B is wrong because 'form' action submits form inputs, not simply a token with the clicked value. Option C is wrong because a static link URL cannot dynamically pass the clicked sourcetype.

Answer

Use a custom JavaScript to navigate.

Answer

Set a drilldown action to 'form' and submit the token.

Answer

Set a drilldown action to 'link' with a URL that includes the sourcetype.

Question 3

A search uses the map command to run a search for each value of a field. The search is taking a very long time. Which alternative approach is recommended for better performance?

Accepted Answer

Use a subsearch with the IN operator instead. Replacing a `map` command with a subsearch using the `IN` operator allows Splunk to retrieve all matching field values in a single search pass, rather than executing a separate search for each value. The `map` command runs one search per input row, which can cause significant overhead and slow performance, especially with large result sets. Using `IN` in a subsearch collects the values first and then applies them as a filter in the outer search, reducing the number of search operations to one.

Answer

Use the sort command

Answer

Use the transaction command

Answer

Use the foreach command to loop over fields

Question 4

An analyst needs to identify events where the field `response_time` is more than 2 standard deviations above the average response_time for the same `host`. Which approach should be used?

Accepted Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`. `eventstats` with a `by host` clause computes the average and standard deviation of `response_time` for each host across the entire result set, then appends those statistics to every event. This allows the subsequent `where` clause to compare each event's `response_time` against the host-specific threshold `avg+2*stdev`, correctly identifying outliers relative to the same host's distribution.

Answer

Use `eventstats avg(response_time) as avg, stdev(response_time) as stdev` then `where response_time > avg+2*stdev`

Answer

Use `streamstats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Answer

Use `stats avg(response_time) as avg, stdev(response_time) as stdev by host` then `where response_time > avg+2*stdev`

Question 5

A search returns events with fields 'user', 'duration', and 'status'. The analyst wants to find users whose average duration exceeds 100 and who have more than 5 events. Which search is correct?

Accepted Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`. It uses the `stats` command to compute the average duration and count per user in a single pass, then filters with `where` to enforce both conditions: average duration > 100 and event count > 5. This is the standard pattern for per-user aggregation followed by post-aggregation filtering in Splunk.

Answer

`... | where avg(duration)>100 | stats count by user | where count>5`

Answer

`... | top user limit=0 | where avg(duration)>100`

Answer

`... | eventstats avg(duration) as avg_dur, count as cnt by user | where avg_dur>100 and cnt>5`

Answer

`... | stats avg(duration) as avg_dur, count as cnt by user | having avg_dur>100 and cnt>5`

Question 6

Refer to the exhibit. An analyst runs a search over access_combined events and notices that some events are not getting the region_name and region_code fields. Which TWO changes could resolve this issue? (Choose two.)

Accepted Answer

Check whether the field used for the lookup (clientip) is correctly extracted in the events. If the `clientip` field is not properly extracted from the events, the lookup against `regions.csv` will fail to match, resulting in missing `region_name` and `region_code` fields. The lookup command or LOOKUP- stanza relies on a correctly extracted field to perform the key-value match; without it, no enrichment occurs.

Answer

Increase max_matches to a higher value

Answer

Remove the LOOKUP- stanza and use the lookup command in each search

Answer

Set default_match to the desired default values for all fields

Question 7

Refer to the exhibit. The lookup 'lookup_user_info' is used in a search: `| lookup lookup_user_info user_id OUTPUT department`. Users report that many events show 'UNKNOWN' as department even though the user_id exists in the CSV. What is the most likely cause?

Accepted Answer

The field name in the CSV header is 'User_ID' (capital U), while the event field is 'user_id' (lowercase). Splunk field matching is case-sensitive.. Splunk lookups are case-sensitive when matching field values. The exhibit shows the CSV header uses 'User_ID' (capital U), while the search references 'user_id' (lowercase). Since the lookup field name in the definition must exactly match the event field name, the mismatch causes the lookup to fail, returning 'UNKNOWN' for all events even when the user_id exists in the CSV.

Answer

The lookup file is not distributed to all indexers.

Answer

The match_type is not specified, defaulting to EXACT, but the CSV contains case variations.

Answer

The max_matches should be set to 0.

Answer

The lookup definition is missing the default_match setting, which should be set to 'no_match'.

Question 8

A large enterprise uses multiple Splunk search heads. An admin wants to create a saved search that automatically runs on all search heads and sends a single alert email per triggered result, not per search head. Which saved search setting should be configured?

Accepted Answer

Set Alert Type to 'Per Result' to trigger an alert for each matching event.. Setting the Alert Type to 'Per Result' ensures that an alert is triggered for each matching event in the search results. In a multi-search head environment, the saved search runs on all search heads, potentially causing duplicate alerts. However, to achieve a single alert per triggered result, you must first enable per-result alerting. Options such as throttling or using a dedicated search head can then be used to deduplicate. Option B (Alert Suppression) suppresses consecutive identical alerts from the same search, which does not address cross-head duplication. Options A and D are unrelated to the alerting mechanism. Therefore, C is the key setting among the choices.

Answer

Set the time range to 'Real-time' to capture events as they happen.

Answer

Enable 'Alert Suppression' to suppress duplicate alerts.

Answer

Set the Schedule to 'Continuous' to avoid duplicates.

Question 9

A data engineer has defined a CIM data model for 'Network_Traffic'. They have also created field aliases using `| fieldaliases` to map custom fields like `src_ip` and `dest_ip` to the CIM fields. When running searches against the data model, some events do not appear. The engineer verified that the tags are correctly applied. What is the most likely remaining issue?

Accepted Answer

The field aliases must be defined within the data model itself, not via `| fieldaliases`.. Field aliases defined using the `| fieldaliases` command are applied at search time but are not recognized by data model acceleration. Data models use their own field definitions and aliases must be defined within the data model itself (via the data model editor) to be included in accelerated searches. Option B is incorrect because the time range would affect all events equally and does not explain why some events are missing specifically due to field mapping. Option C is incorrect because custom fields do not need to be indexed; they can be extracted at search time, but the issue is that the aliases are not applied within the data model. Option D is incorrect because tags are correctly applied as verified, so the problem is not tag application.

Answer

The data model search is using a time range that excludes the events.

Answer

The custom fields are not indexed, so they cannot be used in data models.

Answer

The tags are applied only to a subset of events.

Question 10

A large enterprise runs Splunk Enterprise with 500 servers forwarding Windows security logs. The security team wants to correlate failed logins (EventCode 4625) with subsequent successful logins (EventCode 4624) from the same source IP within a 5-minute window. They currently use the following search: index=windows sourcetype=WinEventLog:Security (EventCode=4625 OR EventCode=4624) | transaction src_ip maxpause=5m | search EventCode=4625 AND EventCode=4624. This search is extremely slow and often times out. Which approach would improve performance while maintaining the same correlation logic?

Accepted Answer

Replace transaction with a combination of stats and where that groups by src_ip and then filters for pairs.. Using stats and where is more efficient than transaction. Transaction holds all events in memory until the transaction is closed, which is memory-intensive when dealing with many events like 500 servers. The stats command can group events by src_ip, then the where command can filter for pairs of EventCode 4625 and 4624 within the same group. This approach leverages streaming capabilities and reduces memory overhead. Option A is incorrect because the append command does not correlate events by source IP; it merely concatenates results from two separate searches. Option B is incorrect because adding maxevents=1000 (already default) limits the number of events per transaction but does not address the underlying memory consumption issue of transaction. Option C is incorrect because increasing maxpause to 10 minutes would allow more events per transaction, making the search even slower and more prone to timeout.

Answer

Use the append command to combine the two event types after separate searches.

Answer

Add maxevents=1000 to the transaction command to limit event count.

Answer

Increase maxpause to 10 minutes to allow more events per transaction.

Question 11

A Splunk administrator is correlating events from two sourcetypes using transaction with startswith and endswith. The transaction rarely matches events even though they exist. What is the most likely cause?

Accepted Answer

Events from the two sourcetypes are not in chronological order.. The most likely cause is that events from the two sourcetypes are not in chronological order. The transaction command, by default, requires events to be processed in time order, and if events from different sourcetypes are interleaved or out of sequence, the transaction may fail to match a complete sequence. Option A is incorrect because a high maxpause would make the transaction more likely to match, not less. Option C is incorrect because the fields option is not required for the transaction to work; it is used to identify the transaction. Option D is incorrect because overly broad patterns would cause too many matches, not too few.

Answer

The maxpause value is too high.

Answer

The fields option is missing.

Answer

The startswith and endswith patterns are too broad.

Question 12

You are a Splunk consultant for a financial services firm. They have a large lookup table containing customer account numbers and risk scores. This lookup is used in a critical compliance search that runs every hour. The search is failing with a memory error 'The search coordinator stopped the search due to memory usage'. You have already tried increasing the memory limit for the search via limits.conf, but the error persists. The lookup file is a CSV file of 2GB, with approximately 20 million rows. The search is: index=compliance sourcetype=transactions | lookup risk_scores.csv account_id OUTPUT risk_score | stats avg(risk_score) by transaction_type. The search runs on a single search head with 16GB RAM. The lookup is defined as static. What is the most effective optimization to resolve the memory error?

Accepted Answer

Convert the lookup to a KV store collection and use the 'kv' command in the search.. Converting the static CSV lookup to a KV store collection allows the lookup data to be stored in memory as a key-value store, which is optimized for high-performance lookups and can handle large datasets more efficiently than loading the entire CSV into memory. The KV store uses indexing and can serve lookups without loading the whole file, resolving the memory error. Option A is wrong because using 'inputlookup' with a 'where' clause still loads the entire CSV into memory before filtering, so the memory error persists. Option B is wrong because splitting the lookup into multiple files does not reduce the total memory required; the search still needs to load all files. Option D is wrong because 'lookup local=false' distributes the lookup to indexers, but the indexers would still need to load the CSV into memory, and the search head coordinates the search, which may still cause memory issues. Converting to KV store is the most effective optimization for this scenario.

Answer

Use 'inputlookup' with a 'where' clause to filter the lookup to only relevant account IDs before joining.

Answer

Split the lookup into multiple smaller files and use multiple lookups in the search.

Answer

Use 'lookup local=false' in the search to distribute the lookup to indexers.

Question 13

A large e-commerce company runs Splunk Enterprise on a single indexer cluster with four indexers. They have been experiencing slow search performance during peak hours, especially for searches that cover the last 24 hours. The environment uses a default search time range of 'Last 30 days'. The team has noticed that searches often time out or return partial results. They have also observed high CPU usage on the search head during peak times. The company's data volume is approximately 500 GB per day across various sources. They have implemented some search acceleration for data models, but the issue persists. The security team needs to run ad-hoc searches for threat hunting that cover multiple sourcetypes over the last 7 days. Additionally, the search head has a memory limit that is sometimes reached. The security team's searches are complex and involve joins and subsearches. The existing acceleration only covers a few data models. The team is looking for a quick win that does not require significant infrastructure changes. Which course of action would most effectively improve search performance without compromising data completeness?

Accepted Answer

Reduce the default time range to 'Last 7 days' and encourage users to specify shorter time ranges. Reducing the default time range from 'Last 30 days' to 'Last 7 days' directly reduces the data scanned by searches, which is the most effective quick win without infrastructure changes. Since the environment has high CPU usage on the search head and searches often time out, limiting the default time range reduces the load on the indexers and search head, improving performance for the majority of searches. This change does not compromise data completeness because users can still specify longer time ranges when needed.

Answer

Implement a data model for all sourcetypes and enforce using tstats for all searches

Answer

Increase the number of indexers to distribute the load

Answer

Use the search head clustering feature to distribute search load across multiple search heads

Question 14

Refer to the exhibit. A search uses the macro as `| `fillnull(field=user)`. However, the search fails with a syntax error. What is the most likely issue?

Accepted Answer

The macro definition contains unescaped commas. In macro definitions, commas that are part of the code need to be escaped with a backslash because commas are used to separate macro arguments. The `if` function in the macro definition uses commas, and they are not escaped, so the macro expansion is broken. Option A is incorrect; the invocation with `field=` is a valid way to pass named arguments. Option C is incorrect; named arguments are allowed and not the issue. Option D is incorrect; a leading pipe is not needed inside the macro definition because the invocation already provides a pipe before the macro name.

Answer

The macro argument should be passed without the `field=` prefix

Answer

The macro definition should use positional arguments instead of named

Answer

The macro definition should include a pipe before `eval`

Question 15

An analyst runs this search and gets a chart with only the top 5 hosts per time bucket, but the total count per bucket is much higher than the displayed counts. What is the issue?

Accepted Answer

The chart is missing a 'useother=t' option to aggregate the remainder into an 'Other' bucket.. The timechart command, by default, limits the number of series per time bucket (default 10). Without useother=t, any hosts beyond the top N are discarded, not aggregated. This explains why the total count per bucket is higher than the displayed counts. Using useother=t adds an "Other" bucket that sums the counts for all remaining hosts, so the total per bucket matches the overall count. Option B is incorrect: limit=0 would show all hosts but is not necessary; the issue is aggregation, not limiting. Option C is incorrect: timechart does not automatically create an "Other" bucket. Option D is incorrect: the limit parameter applies per time bucket, not the entire search. Option E is incorrect: while true that limit restricts series per bucket, that restriction causes the mismatch; the fix is to use useother=t to aggregate.

Answer

The limit parameter is misused; it should be 'limit=0' to show all hosts.

Answer

The timechart command automatically uses 'other' for the remaining hosts.

Answer

The limit parameter applies to the entire search, not per bucket.

Answer

The limit parameter restricts the number of series per bucket, but not the overall count aggregation.

Question 16

A web application log contains fields: user, timestamp, response_time. You need to compute the average response time per user, excluding outliers where response_time > 10000ms. Which search produces the correct result?

Accepted Answer

index=web | where response_time < 10000 | stats avg(response_time) by user. It first filters out outliers (response_time < 10000) using the where command, then calculates the average response time per user with stats avg(response_time) by user. This ensures outliers are excluded before the average is computed. Option A is incorrect because it uses if() after stats, which incorrectly modifies the average after it includes outliers. Option B is incorrect because the where clause after stats erroneously filters based on the per-user average itself, not on individual response_time values. Option C is incorrect because eventstats computes an overall average that still includes outliers, and the subsequent filter does not retroactively affect that average.

Answer

index=web | stats avg(response_time) as avg by user | eval avg = if(avg > 10000, null, avg)

Answer

index=web | stats avg(response_time) by user | where response_time < 10000

Answer

index=web | eventstats avg(response_time) as overall_avg | where response_time < 10000 | stats avg(response_time) by user

Question 17

A Splunk admin notices that a time-based lookup (defined in transforms.conf with time_range=TRUE) is not returning correct results for events outside the lookup's time boundaries. The lookup file contains rows with a valid time range. What is the most likely cause?

Accepted Answer

The event time is outside the time range defined in the lookup. When a time-based lookup is configured with time_range=TRUE in transforms.conf, Splunk restricts lookup matches to events whose timestamps fall within the time range specified in the lookup file. If an event's timestamp is outside that range, the lookup will not return any results, even if other fields match. This is the most likely cause because the question explicitly states that events are outside the lookup's time boundaries.

Answer

The lookup is defined as an automatic lookup and runs at index time

Answer

The lookup table has max_matches set to 1, limiting matches

Answer

The lookup file does not contain a time field

Question 18

A large e-commerce company has a Splunk environment ingesting web server logs from multiple data centers. The security team needs to visualize failed login attempts over time, grouped by geographic region. They have a lookup file geo_region.csv that maps IP addresses to regions. The lookup is defined in transforms.conf with max_matches=0 (all matches) and is used as an automatic lookup in props.conf for the sourcetype 'web_access'. The search returns events with multiple region values per IP (because max_matches=0). The team wants a single region per event for accurate counting. They also need to reduce the number of events processed by filtering only login failures (status=401). Which approach should be taken?

Accepted Answer

Modify the automatic lookup to use max_matches=1, and add | where status=401 to the search before the timechart. Modifying the automatic lookup to use max_matches=1 ensures that each event is assigned a single region, eliminating the need for deduplication or expansion. Adding the `| where status=401` filter before the timechart reduces the dataset to only failed login attempts, allowing accurate counting by region over time. This approach is efficient and directly addresses the requirement for a single region per event.

Answer

Use | where status=401 | dedup src_ip | timechart count by region

Answer

Use | where status=401 | mvexpand region | timechart count by region

Answer

Use | where status=401 | top limit=100 region

Question 19

A large e-commerce platform uses Splunk to monitor user sessions. Each session is composed of multiple events with a common 'session_id' field. The current search to compute average session duration is: 'index=web | transaction session_id maxspan=30m | eval duration=_time_last - _time | stats avg(duration)'. This search runs for over an hour on a 6-hour time window. The environment has 20 indexers and data volume is 2 TB/day. The admin suspects that the transaction command is the bottleneck. Which optimization should be applied?

Accepted Answer

Replace transaction with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'.. The correct optimization is Option C: replacing the transaction command with 'stats earliest(_time) as start latest(_time) as end by session_id | eval duration=end-start | stats avg(duration)'. The transaction command is inefficient because it groups all session events in memory and calculates duration, which consumes significant resources on 20 indexers with 2 TB/day. The stats approach is streaming and reduces data to one row per session before the eval and avg, drastically lowering memory and CPU usage. Option A (reducing time range to 1 hour) might help but doesn't address the core inefficiency and could miss sessions spanning longer than an hour. Option B (adding eventstats before transaction) adds extra processing without removing the bottleneck, still using transaction. Option D (removing maxspan) would allow sessions to remain open indefinitely, increasing memory consumption and potentially causing timeouts. Therefore, Option C is the most effective optimization.

Answer

Reduce the time range to 1 hour.

Answer

Add 'eventstats earliest(_time) as start latest(_time) as end by session_id' before transaction.

Answer

Remove the maxspan parameter from the transaction command to allow longer sessions.

Question 20

A Splunk admin notices that a saved search scheduled to run every 10 minutes is consistently taking 15 minutes to complete, causing overlapping runs. The search aggregates data across multiple indexes and uses a large time window. What is the best way to prevent overlap and ensure the search completes?

Accepted Answer

Configure the search to 'Skip the next scheduled run if the previous run is still in progress'.. The 'Skip the next scheduled run if the previous run is still in progress' setting is specifically designed to prevent overlapping executions of a saved search. This ensures that if a search takes longer than its scheduled interval, the next scheduled run is skipped, avoiding resource contention and incomplete results.

Answer

Set the search to 'Run on a timer' and increase the schedule interval to 20 minutes.

Answer

Enable the 'Schedule Priority' setting to 'Higher' and set 'Schedule Window' to 0.

Answer

Reduce the search time window to 5 minutes to decrease execution time.